Docket No.: 57152/D587 
Amdt date February 15, 2006 



REMARKS/ARGUMENTS 
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A Method for Providing Virtual Private Network Services 

Cross-Reference To Related Application 

This application is a National Phase Patent Application of International Application 
Number PCT/CN2004/00094L filed on August 13, 2004. which claims priority of 
Chinese Patent Application Number 03153613. K filed on August 15. 2003. 

Field of the Technology 

The present invention relates to intelligent network service, more particularly to a 
method for providing Virtual Private Network (VPN) services. 

Background of the Invention 

10 A VPN is a kind of network disposed in a public network infi-astructure. The whole 

VPN network is a logic network constructed upon a network platform provided by a 
public network service provider, and there is no end-to-end physical link as required in a 
traditional private network between any nodes of the VPV network. User data are 
transmitted through logic links. A VPN service is a kind of intelligent network services. 

15 Its main object is to define telephone users of a company or a team as one group, and 
allocate each user within this group with a short number which can be used inside the 
group, and users within this group can directly call one another by dialing the short 
number. 

To resolve the problem of user's malicious overdrawing, it is feasible to adopt 
20 prepaid services. A prepaid service is an important service provided by an intelligent 
network. A prepaid user needs to deposit a certain amoxmt of fee in his prepaid account 
before calling and commimication fee will be deducted fi*om the corresponding account 
j real-timely. If the fee in the account is used up, a current call will be terminated and the 
corresponding user terminal cannot initiate a call until this account is recharged. 
25 Op e rators e xpect to gradually e xpand th e amount of pr e paid us e rs b e cause the 

pr e paid s e rvic e is of great guarantee. However, sinc e both the VPN s e r\^ico and th e 
pr e paid ser\ao e belong to intelligent network sorv^io e s that ar e with certain limitations that 
diff e r e nt servic e s are independent, prepaid service users cannot us e other intelligent 
s e rvices of on int e llig e nt n e twork. For instanc e , at present a pr e paid user is not capable of 
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joining a VPN group as a mombor to utilize VPN sor\ioo9. Meanwhil e , the number of 
prepaid users is continuously incr e asing currently. How e ver, a user will not be able to 
e njoy a WN service oimultanoously once appljdng for a prepaid scrvioo, which brings 
groat limitations for op e rators' VPN s e rvic e e xpansion. 

Summary of the Invention 

The refore, a main object of the present invention isrelates to provid e a method for 
providing a Virtual Private Network (VPN) s e rvic e that supports pr e paid users to utilize 
VPN services, so as to e xpand application ar e a of VPN services. 
10 A m e thod for providing a V PN service according to the present invention which 

comprises the steps of: 

A. after receiving a call request for a VPN service ft-om a user terminal, a Service 
Control Point (SCP) judging whether the user terminal has applied for a prepaid service-a^ 
th e same time , if so, executing step B, otherwise directly providing th ea traditional VPN 

15 service for the user terminal and e nding th e current flow ; and 

B. initiating a VPN service logic, invoking a prepaid service logic by the VPN 
service logic, and deducting fee from a prepaid account corresponding to the user 
terminal while providing the VPN service to the user terminal. 

Step — Wherein the step of A may furth e r compris e the stop of comprises: 
20 implementing VPN service authentication for the user terminalT-4£ if the user terminal 
passes the VPN service authentication, executing t he step of judging whether the user 
terminal has applied for the prepaid service at the same time will bo oxooutod , otherwise 
returning a VPN service authentication failure message will bo rotumod t o the user 
terminal and th e curr e nt flow will b e e nd e d . 
25 B e for e st e p B, the m e thod may further compriso Wherein the step of A is followed by 

a fixrther step of implementing prepaid service authentication for the user terminal^-4C if 
the user terminal passes the prepaid service authentication, executing step B will be 
ex e cuted , otherwise returning a prepaid service authentication failure message will bo 
r e turned to the user terminal and the ourront flow will be ended . 
30 Implem e nting th e W herein the step of implementing p repaid service authentication 

for the user terminal is followed by a further step of presetting an authentication interface 
for the prepaid service, wherein implementing the prepaid service authentication for the 



user terminal is implemented by invoking the authentication interface set for the prepaid 
service. Th e 

Wherein the step of implementing the prepaid service authentication for the user 
terminal comprises the otepa of : judging whether the user terminal's corresponding 
prepaid account is valid and judging whether there is sufficient balance in the prepaid 
account. 

Preferably, the method further comprises the step of presetting a fee-applying 
interface for the prepaid servic e. Befor e , before providing the VPN service for the user 
terminal^i 

Wherein the step of B furth e r comprises: 

the VPN service logic invoking the fee- applying interface, the prepaid service logic 
applying for fees and notifying the VPN service logic of a fee application result; and 

the VPN service logic judging whether the fee is obtained according to the fee 
application result, if so, providing the VPN service for the user terminal according to the 
fee application result, otherwise ending the current flow directly. 

Preferably, the method further comprises the step of presetting a fee-deducting 
interface for the prepaid service. Tho 

Wherein the step of deducting op e ration in st e p B fee from a prepaid account 
corresponding to the user terminal while providing the VPN service to the user terminal 
comprises: 

when the call is finished, the VPN service logic invoking the fee-deducting interface 
and sending a fee-deducting request to the prepaid service logic, the prepaid service logic 
deducting a certain amount of fee from the applied fee aft e r r e ceiving th e r e qu e st . 

Preferably, the method further comprises the step of presetting a fee-retuming 
interface for the prepaid service. After th e 

Wherein the step of deducting op e ration in step B, th e m e thod furth e r compris e s fee 
from a prepaid account corresponding to the user terminal while providing the VPN 
service to the user terminal is followed bv the step of : the VPN service logic judging 
whether there is remaining fee in the applied fee, if so, invoking the fee-retuming 
interface and returning the remaining fee to the prepaid accovmt corresponding to the user 
terminal ; othorwiso ending tho current flow directly . 

It can be seen from the technique scheme of the present invention, after receiving a 
VPN service request, a SCP continues to judge whether the user terminal has applied for a 



prepaid service. If the user terminal applying for VPN service has applied for prepaid 
service, the VPN service logic will invoke prepaid service logic by invoking the preset 
prepaid service interface so that prepaid service users can also utilize VPN services. In 
this way, a ea prepaid service user can use other intelligent services of an intelligent 
network. Therefore, not only prepaid users are facilitated, but also a problem which 
long-harasses operators is resolved, so that the operators can popularize VPN service 
among numerous prepaid service users with great economic interests for the operators. 

Brief Description of the Drawings 

Figure 1 is a flowchart illustrating a VPN service according to an embodiment of t he 
present invention. 

Detailed Description of the Invention 

To make the object, technique scheme and advantages of the present invention clear, 
the present invention will be described in detdl hereinafter with reference to 
accompanying drawings and embodiments. 

The key idea of an embodiment of the present invention is: a user terminal with 
fimctions of both a VPN service and a prepaid service sends a call request for a VPN 
service to a SCP; after receiving this request, the SCP implements VPN service 
authentication for this user terminal at first. If the us e r t e rminal pass e s the V PN service 
authenticatio n passed , the SCP continues to implement prepaid service authentication for 
this user terminal, such as determining whether there is available fee in the prepaid 
account corresponding to the user terminal. If there is available fee in the corresponding 
prepaid account, the user terminal is allowed to implement a call and communication fee 
will be deducted fi-om the prepaid account corresponding to the user terminal. 

To realize the above-mentioned key idea, priority of VPN service is set higher than 
that of prepaid service in the embodiment of the p resent invention, thereby when a user 
terminal applying for both VPN and prepaid intelligent services starts a call, the VPN 
service with higher priority is firstly initiated and then the prepaid service is initiated 
through service invoking. Similar to fimction invoking, service invoking is to define 
various independent ftinctions as invoking interfaces which are similar to Amotions in a 
prepaid service and to publicize these interfaces for other services to invoke. Certainly, 
various fimction interfaces set in a prepaid service can be extended on need of other 



services upon the prepaid service. With these function invoking interfaces, other services 
to be prepaid will invoke these relevant interfaces to utilize various functions of a prepaid 
service. Because each service in an intelligent network is fulfilled through corresponding 
service logic, the service logic used to implement VPN service is called VPN service 
5 logic and the service logic used to implement prepaid service is called prepaid service 
logic. 

In order to realize invoking for prepaid services, relevant function invoking 
interfaces of a prepaid service is defined, the interface including: authentication interface, 
fee-applying interface, fee-deducting interface and fee-returning interface. Utilization of 

10 prepaid service by other services generally requires using fee in the prepaid account, but 
according to service characteristic of a prepaid service, authentication is necessary before 
fee in the prepaid account is used, thus an authentication interface is defined. At present, 
authentication processing mainly includes determining prepaid account balance, valid 
period of a prepaid user, minimum threshold of a prepaid user account, whether the user 

15 reports a loss, whether the user is blocked, etc. As the fee in a prepaid account is for 
multiple utilities, the user must apply to use the fee in the prepaid account and cannot use 
the service before acquiring the applied fee, thus a fee-appljdng interface is defined in 
order to transmit information when a user applies for fees. After the fee in the prepaid 
accoimt is used for VPN service, to guarantee accuracy of the fee in the prepaid account, 

20 relevant fee should be deducted from the prepaid user's accoimt real-timely, thus a fee 
deducting interface is defined to notify interface parameters used in deduction by prepaid 
service. After the user finishes VPN service, the remaining fee must be retumed to the 
prepaid account if there is any in the applied prepaid service account, so as to guarantee 
the accuracy of fee in the prepaid account, thus a fee-returning interface is defined in the 

25 I embodiment of the present invention. 

After defining the above interfaces, with reference to figure 1 , a specific procedure 
I of providing a VPN service for a prepaid service user according to the embodiment of the 
present invention is as follows: 

Steps 1 01-- 102: a user termined sends a call request to a SCP, requesting for a VPN 

30 service. The SCP implements authentication for this user terminal after receiving the call 
request and judges whether this user terminal has signed a contract for VPN service 
according to this user terminal's contract information. If so, the SCP will initiate a VPN 
service logic. Then, the SCP furflier judges whether the user terminal has signed a 
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contract for prepaid service according to the user terminars contract information, if so, a 
VPN service logic will invoke authentication interface of the prepaid service to send an 
authentication request to the prepaid service logic, and then step 103 will be executed. If 
the user terminal has a contract for VPN service but has not a contract for prepaid service, 
5 the user terminal will be provided with traditional VPN service; if the user terminal has 
no contract for VPN service, the VPN service is failed and cxirrent call is ended. 

Steps 103-'! 04: after receiving an authentication request from a VPN service logic, 
the prepaid service logic implements authentication for this user terminal and notifies the 
VPN service logic of the authentication result. Here, the processing of prepaid service 

10 authentication mainly includes judging whether the corresponding prepaid accoimt of the 
user terminal is valid and whether there is sufficient balance in the account. 

Steps 105-107: after receiving the prepaid service authentication result, the VPN 
service judges whether the user terminal passes the p repaid service authentication passes 
according to the authentication result, if so, the VPN service invokes a fee-applying 

15 interface and sends a fee application request to the prepaid service logic, otherwise, the 
VPN service is failed and the current call flow is ended. After receiving this fee 
application request, the prepaid service logic judges whether there is sufficient fee in the 
user terminal's corresponding prepaid account, if so, allocates a certain amoimt of fee for 
this user terminal, namely freezing the certain amoimt of fee in the account and rejecting 

20 other services to utilize this part of fee, and then notifies the VPN service logic of fee 
application result. Otherwise, the prepaid service logic notifies the VPN service logic of 
the fee application result that no fee is applied. After receiving the fee application result, 
the VPN service logic judges whether the fee is obtained according to the fee application 
result, if so, continues to execute subsequent steps, otherwise ends the current flow 

25 directly. Here, this user terminal's corresponding prepaid account may provide prepaid 
services of multiple intelligent services simultaneously, so judging of whether there is 
available fee is to judge whether there is available fee in this user terminal's 
corresponding prepaid accoimt to be provided for the VPN service. 

Steps 108-111 : after receiving the notification of obtaining fee for the VPN service, 

30 the VPN service logic starts a call, monitors the call and calculates the fee of current call 
when the call is over, and invokes fee-deducting interface of the prepaid service to deduct 
fee from the prepaid account. If the deducted fee is less than applied fee, namely there is 
still remainder in the applied fee, the VPN service logic will continue to invoke 



6 



fee-returning interface and retxrni the remaining fee to the corresponding prepaid account, 
which means to defreeze the frozen remaining fee so that other services can utilize this 
part of fee. And then the prepaid service logic is notified that processing is over. Certainly, 
if there is no fee remained, such step as returning fee can be omitted. 

It can be seen from the embodiment abov e , with of the present inventio n mentioned 
above, a user can sign a VPN service and a prepaid service in a SCP at the same time. 
When a user sends a call request, the SCP initiates a VPN service logic. And during the 
processing of a VPN service, the VPN service logic triggers a prepaid service logic, so 
that a prepaid service user is capable of enjoying a VPN service. 

The method of the embodiment of the p resent invention can be applied in various 
intelligent networks, such as CDMA-based intelligent network or GSM-based intelligent 
network. 

While the invention has been shown and described with reference to a preferred 
embodiment thereof, it will be understood by those skilled in the art that various changes, 
equal substitution and improvement in form and details may be made therein without 
departing from the spirit and scope of the invention as defined by the appended claims. 



Abstract 

The present invention discloses a method for providing a Virtual Private Network 
(VPN) service. The method comprises the steps of: after receiving a call request from a 
user terminal, a Service Control Point (SCP) judging whether the user terminal has 

5 applied for a prepaid service at the same time, if so, initiating a VPN service logic, 
invoking a prepaid service logic by the VPN service logic, and deducting fee from a 
prepaid account corresponding to the user terminal while providing the VPN service to 
the user terminal. With the present invention, a VPN service can be provided for a prepaid 
service user, which not only brings convenience for prepaid service users, but also 

10 prompts expansion of VPN service, thus bringing great interests for the operators. 
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